Baslinux mailing list

[Karolis Lyvens <karolisl AT gmail.com>]

On Sun, Jan 28, 2007 at 12:14:34PM +0000, Lee Forrest wrote:
-snip-
> That's garbage. Makes it look like I'm running an incredibly busy
> server with an excellent firewall. I don't have most of those
> apps on this box. In fact, I've never even _heard_ of most of
> them. And I'm not running any network daemons/(super)servers. I
> have an FTP server, but it's not up.

It might have been you. "Filtered" ports mean this:

It (scanner) sent a packet to this port, but got back nothing. Meaning
that packets were simply dropped on floor (not replied to). In contrast
to this, "closed" port means that it is unused and, when trying to access
this port, ICMP "REJECT" packet was received (sent to scanner from that
host). Opened port means that a normal reply was gotten from that port.

On nmap, if you use "-P0", ie, omit ping test, you'll get ALL ports
"filtered", although the host isn't even up.

These "filtered" ports tend to confuse this mailing list :)

So, in short, "filtered" port means that the port is unused and no reply
was gotten from it

> I wouldn't use this site. It could get you in trouble. They could
> have nmap configured to give _your_ IP as the origin of the
> probe. Such capabilities are strongly-implied in the man page.

That site only allows your IP to be scanned. Excerpt from FAQ:

-----
4. How about a port scanner?

A port scanner is a great security tool. It is one of the first things you 
would want 
to do after a new bastion host comes on line. The problems are several. Port 
scanning 
can be used by those with bad intentions to locate vulnerable systems. Port 
scanning will 
often annoy system administrators by setting off intrusion alarms, triggering 
IDS 
systems, causing "paging in the middle of the night" automatic IP blocking, 
snmp trap 
alarms and lot of other issues.
If I can devise a way to overcome ( or at least greatly diminish ) these 
issues...
a port scanner may well be added to the existing tools.

On 5 July 2003 Added port scanner. It will only scan the connected/requesting 
host.
If no security issues develope it will stay and more features may be added as 
time allows.
-----

Karolis